Security Bulletin: IBM® Db2® could allow a DBADM authenticated user to send a specially crafted request to write arbitrary files on the system (CVE-2026-86087)

Summary IBM® Db2® could allow a database administration authority DBADM authenticated user to send a specially crafted request to write arbitrary files on the system CVE-2026-86087 Vulnerability Details CVEID:CVE-2026-86087 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

EUVD-2026-95783

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...

CVE-2026-104629

The openPDC and openHistorian software products are vulnerable to unsafe reflection due to a flaw in their component loading mechanism. The system will construct and execute any specified type, which can be exploited to run arbitrary constructor code . An attacker with authenticated user account ...

CVE-2026-103663

A flaw was found in Ollama. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution by exploiting a path traversal flaw in the model pull application programming interface API endpoint. By supplying a crafted layer identifier, an attacker can write malicio...

CVE-2026-106446

A flaw was found in Handlebars. Incomplete validation of pre-parsed AST objects passed to compile or precompile allows unchecked AST fields to be emitted into generated JavaScript. An attacker who can supply an object instead of a template string can inject and execute arbitrary JavaScript in the...

CVE-2026-106445

A flaw was found in Handlebars. The lookupProperty own-property check returns Function.prototype.constructor before the prototype-method deny list is applied. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

CVE-2026-103413

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

EUVD-2026-95757

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

CVE-2026-103413

Apache Camel Karavan versions 4.0.0 through 4.22.0 are vulnerable to an improper input validation flaw during deployment. The software unmarshals a project's kubernetes.yaml and applies all contained resources to the cluster without restricting resource kinds, rejecting security-sensitive pod opt...

cve-2026-85706

cve-2026-85706 Unauthentifiziertes beliebiges lokales Dateilesen in GitLab CE/EE. Betrifft 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Behoben in 19.1.8 / 19.2.6 / 19.3.2 2026-09-10. CVSS 10.0, Berichten zufolge in freier Wildbahn ausgenutzt. Ursprünglicher Bericht von s3ntago, und dieses Repo ist...

Arbitrary File Access

Docling is vulnerable to arbitrary file read and write. The vulnerability is due to the Tectonic engine compiling untrusted TikZ input without restricting file access, which allows an attacker to read accessible files and create or overwrite writable files, with potential command execution if she...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

CVE-2026-107726

A flaw was found in Hazelcast. Improper validation of client-supplied data allows a connected client to corrupt memory, potentially leading to arbitrary code execution on cluster members. Additionally, an attacker can exploit this vulnerability to read sensitive memory contents from cluster nodes...

CVE-2026-107725

A flaw was found in Hazelcast. Due to missing authorization checks within the IMap Predicates application programming interface API, an authenticated client with limited privileges can bypass access controls. This vulnerability allows an attacker to achieve arbitrary code execution on a cluster...

EUVD-2026-95709

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

BIT-GHOST-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-94503

The PX-lab Zombify WordPress plugin (versions n/a through 1.7.7 ) is vulnerable to an Unrestricted Upload of File with Dangerous Type (CWE-434). This vulnerability allows an attacker to upload a web shell to the web server, potentially leading to unauthorized access and control. No specific remed...